The Director's Pocket: A Board Protocol for Devices, Channels and Travel

Most board packs still treat cyber risk as a property of systems: the finance platform, the customer database, the operational technology estate. A large share of serious incidents begins elsewhere — in a director's own working habits. A personal messaging group used to move a deal forward, a phone that has never been enrolled in mobile device management, a home router shared with a household, a hotel network used to clear email before an early meeting. Individually these look like convenience. Collectively they form a parallel estate that sits outside the controls the board has approved.

For UK boards, the question is not whether directors should work flexibly. It is whether the organisation has a proportionate protocol for the devices, channels and journeys that directors actually use. The protocol should be short enough to be followed, specific enough to be tested and owned by someone with the authority to enforce it.

The channel is the first control

Board business should travel through approved channels. That sounds obvious until a crisis breaks and the fastest route to a fellow director is a personal WhatsApp group that nobody has risk-assessed. The protocol should name the approved tools for board papers, urgent decisions and out-of-hours contact. It should also state what may never cross informal channels: transaction terms, personal data, incident details, legal advice, credentials and payment instructions.

Where a messaging tool is tolerated for logistics, treat it as a logistics tool only. Define the boundary in plain language and repeat it at induction. A director who joins a private group to arrange dinner should not thereby create an unmanaged record of board deliberation. If the organisation relies on a collaboration platform, enable the controls it already offers: access reviews, retention settings, external-sharing restrictions and the ability to remove a leaver promptly.

Device hygiene is an executive control

A director's unmanaged phone is not a personal matter when it holds board papers, email and calendar access. The board should expect the same basic posture on executive devices as it does on finance laptops: encryption, screen lock, current patching, endpoint protection and remote wipe. Where personal devices are permitted, use a managed profile or container so that company data can be removed without touching family photos.

The uncomfortable question is not whether directors resent controls. It is whether the organisation can prove, at least annually, that its most privileged users are covered. A short attestation — device enrolled, operating system current, messaging apps reviewed — is more useful than a lengthy policy that nobody reads. The board's audit committee can ask for the coverage figure without turning the conversation into a technical seminar.

The home network is part of the estate

Home working did not end when offices reopened. A director's home router is now an extension of the executive estate. Default credentials, outdated firmware and a flat network shared with smart speakers and games consoles create a route that no corporate firewall sees. The advice need not be elaborate: change default administrator passwords, apply firmware updates, use a separate guest network for visitors and work devices, and avoid administering sensitive systems from a household account.

For directors with access to highly sensitive material, a simple home-network checklist at induction is proportionate. It is also a useful signal that security is not something the organisation outsources to a departmental team.

Travel is a known targeting window

Executive travel compresses risk. A director is away from familiar systems, using unfamiliar networks, carrying more data than usual and often making decisions under time pressure. Airports, hotels and conference venues are routine hunting grounds for credential theft and device compromise. The protocol should include a pre-travel briefing for higher-risk journeys: which devices to carry, what to leave behind, how to connect, whom to call if something looks wrong.

For high-risk destinations, consider a clean loan device with only the data needed for the trip. Avoid public charging points and unknown USB ports. Use a trusted VPN on hotel and airport networks. Do not leave devices unattended in rooms or vehicles. If border officials request access to a device, the director should know the organisation's position before departure rather than improvising at the desk.

Travel briefings should be routine, not alarming. A ten-minute conversation before a long-haul trip is cheaper than an incident response exercise after a credential has been harvested.

What is a director's inbox worth?

Attackers value a director's inbox for its position, not its size. It contains authority, relationships, calendar patterns, sensitive attachments and the tone of voice that colleagues recognise. A single well-crafted email from a known address can authorise a payment, unlock a conversation or persuade a finance team to bypass a control. That is why business email compromise remains so effective: it borrows trust rather than breaking encryption.

Boards should treat executive email as a crown-jewel asset. That means strong authentication, conditional access, mailbox rules monitoring and a clear route for reporting suspicious messages. It also means accepting that the value of an inbox is contextual. The same mailbox may be worth little to one attacker and a great deal to another. The board's job is to reduce the chance that the second attacker gets the first opportunity.

A one-page protocol

The protocol need not be a manual. It should fit on one page and cover five points: approved channels for board business; minimum device posture for directors; home-network basics; a travel briefing for higher-risk journeys; and a named contact for reporting a lost device or suspicious message. Add an annual attestation and a short tabletop exercise so that the protocol is tested rather than filed.

The boardroom is not an abstract governance layer. It is a collection of people with phones, inboxes, calendars and travel schedules. Securing that surface is not about distrust. It is about recognising that directors are targets precisely because they are trusted. A proportionate protocol protects the organisation without turning its most senior people into exceptions to the controls everyone else is expected to follow.